CVE-2026-62815 Google Chronicle · YARA-L

Detect Microsoft MsQuic (MsQuic.OpenSSL/Schannel) Use-After-Free RCE — CVE-2026-62815 in Google Chronicle

Detects exploitation attempts and vulnerable deployments of Microsoft's MsQuic library (the Microsoft.Native.Quic.MsQuic.OpenSSL and Microsoft.Native.Quic.MsQuic.Schannel NuGet packages) affected by CVE-2026-62815, a CWE-416 use-after-free permitting unauthenticated remote code execution over QUIC/UDP. Affected versions are >= 2.5.3 and < 2.5.10, and all versions < 2.4.19. The vulnerability is triggered by crafted QUIC handshake/connection traffic that causes a freed connection or stream object to be reused; exploitation typically manifests as anomalous QUIC (UDP/443) traffic to msquic-linked processes, crashes/restarts of QUIC-enabled services, and spawning of child processes from QUIC server binaries. This detection surfaces vulnerable package/binary presence, abnormal crash telemetry of msquic-linked services, and suspicious post-exploitation child-process activity. Exploit status: public PoC available (GHSA-92f5-vc22-8j33).

MITRE ATT&CK

Tactic
Initial Access Execution

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule msquic_cve_2026_62815_exploitation {
  meta:
    author = "Argus"
    description = "Detects vulnerable MsQuic module load and suspicious QUIC-parented process for CVE-2026-62815"
    severity = "HIGH"
    reference = "https://github.com/microsoft/msquic/security/advisories/GHSA-92f5-vc22-8j33"
  events:
    (
      $e.metadata.event_type = "PROCESS_MODULE_LOAD" and
      re.regex($e.target.file.full_path, `(?i)(msquic\.dll|libmsquic\.so)`)
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.principal.process.parent_process.file.full_path, `(?i)quic`) and
      $e.target.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|\/bash|\/sh|rundll32\.exe)/
    )
    $e.principal.hostname = $host
  match:
    $host over 5m
  condition:
    $e
}
high severity medium confidence

Chronicle YARA-L rule detecting vulnerable msquic module loads and QUIC-parented shell/LOLBin execution for CVE-2026-62815.

Data Sources

Windows SysmonLinux EDR

Required Tables

UDM

False Positives & Tuning

  • Patched QUIC applications loading msquic modules.
  • Legitimate QUIC service helper processes.
  • Test/dev environments running msquic samples.

Other platforms for CVE-2026-62815

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Inventory vulnerable msquic package version (Windows)

    Expected signal: File enumeration and DeviceImageLoadEvents/Sysmon EventID 7 for msquic.dll with FileVersion recorded.

  2. Test 2Simulate QUIC-parented shell spawn (Linux)

    Expected signal: Process creation events with a 'quic'-named parent launching bash/sh (auditd execve / Sysmon-for-Linux EventID 1).

  3. Test 3Replay benign QUIC handshake burst to trigger crash telemetry (Linux)

    Expected signal: UDP/443 traffic to the msquic listener and, on a vulnerable build, service crash/restart entries (WER / coredump / systemd restart).

Last updated: 2026-09-18 Research depth: standard
References (9)

Response Playbook

Triage

  1. Confirm the affected host loads a vulnerable msquic binary: enumerate the installed Microsoft.Native.Quic.MsQuic.OpenSSL / .Schannel NuGet package version and verify whether it falls in the vulnerable ranges (>= 2.5.3 and < 2.5.10, or < 2.4.19).
  2. Identify all processes on the host that link msquic (msquic.dll / libmsquic.so) and determine which expose QUIC/UDP listeners reachable from untrusted networks.
  3. Review crash/restart telemetry (Windows WER, WinEventLog Application EventID 1000/1001, systemd/coredump on Linux) for QUIC-linked services around the alert time — repeated crashes suggest UAF exploitation attempts.
  4. Correlate any suspicious child processes (shells, LOLBins) spawned by QUIC-linked parents with the module-load events to establish an exploitation chain.

Containment

  1. Isolate or firewall the affected host's QUIC/UDP listener (commonly UDP/443) from untrusted networks until the msquic package is upgraded to 2.4.19 or 2.5.10 (or later).
  2. Upgrade the Microsoft.Native.Quic.MsQuic.OpenSSL / .Schannel NuGet package to a fixed version and redeploy the affected service; where immediate patching is impossible, disable QUIC/HTTP3 on the exposed service.

Evidence Collection

  1. Capture the exact vulnerable binary (msquic.dll/libmsquic.so) with hash and file version, plus the NuGet package manifest/lockfile showing the resolved version.
  2. Preserve crash dumps / core dumps of the QUIC-linked process and any PCAP of the QUIC/UDP traffic around the crash for reverse-engineering the trigger.

Escalation Criteria

  • !Escalate to incident response if a QUIC-linked service is observed spawning shells/LOLBins or performing outbound C2, indicating successful RCE.
  • !Escalate if the vulnerable service is internet-facing and unauthenticated QUIC traffic from unknown sources coincides with service crashes.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Crash dumps / core dumps of the QUIC-linked process showing free-then-use access violations in msquic call frames.
  • >The resolved vulnerable msquic binary version recorded in the NuGet lockfile / assembly metadata, plus Sysmon EventID 7 image-load records.

Tuning Guidance

Build an allowlist of patched msquic binary hashes/versions (>= 2.4.19 or >= 2.5.10) and suppress module-load-only signals for those. Focus alerting on the correlation branch (msquic load + QUIC-parented shell/LOLBin, or QUIC service crash bursts) rather than mere presence of msquic, which is common in browsers and .NET apps. Baseline expected child processes of your QUIC services to reduce false positives from legitimate helper spawning.

Hunting Queries

Inventories every host that has loaded an msquic module so vulnerable versions can be cross-referenced against the fixed release baselines.

Hunting — KQL
kql 
DeviceImageLoadEvents | where FileName in~ ("msquic.dll","libmsquic.so") | summarize hosts=make_set(DeviceName), first=min(Timestamp), last=max(Timestamp) by SHA256, FolderPath
Hunting — SPL
spl 
(sourcetype="Sysmon:ImageLoad" OR EventCode=7) (ImageLoaded="*msquic.dll*" OR ImageLoaded="*libmsquic.so*") | stats values(host) AS hosts min(_time) AS first max(_time) AS last by ImageLoaded

Atomic Red Team Tests

Test 1 Inventory vulnerable msquic package version (Windows)
windows

Enumerates installed msquic assemblies and NuGet package versions to detect a vulnerable range without triggering the actual UAF.

Command

powershell 
Get-ChildItem -Path C:\ -Recurse -Filter msquic.dll -ErrorAction SilentlyContinue | ForEach-Object { [PSCustomObject]@{ Path=$_.FullName; Version=(Get-Item $_.FullName).VersionInfo.FileVersion } }

Cleanup

powershell 
echo 'No changes made; inventory only.'

Expected Telemetry

File enumeration and DeviceImageLoadEvents/Sysmon EventID 7 for msquic.dll with FileVersion recorded.

Expected Detection

Hunting query lists the host and flags any msquic.dll with version >= 2.5.3 < 2.5.10 or < 2.4.19.

Test 2 Simulate QUIC-parented shell spawn (Linux)
linux

Spawns a shell from a process named to mimic a QUIC server binary to validate the post-exploitation correlation branch of the detection.

Command

bash 
cp /bin/sleep ./quic-server-test && ./quic-server-test 1 & sleep 0.2; setsid bash -c 'bash -c whoami' >/dev/null 2>&1; wait

Cleanup

bash 
rm -f ./quic-server-test

Expected Telemetry

Process creation events with a 'quic'-named parent launching bash/sh (auditd execve / Sysmon-for-Linux EventID 1).

Expected Detection

EQL sequence and SPL/CQL correlation branch fire on quic-parented shell execution.

Test 3 Replay benign QUIC handshake burst to trigger crash telemetry (Linux)
linux

Sends a burst of malformed UDP/443 QUIC-like packets at a lab msquic listener to exercise crash/restart telemetry paths (lab only, against a disposable test service).

Command

bash 
for i in $(seq 1 50); do printf '\xc0\x00\x00\x00\x01\x08\xde\xad\xbe\xef' | nc -u -w1 127.0.0.1 443; done

Cleanup

bash 
echo 'No persistent changes; stop the lab msquic listener manually.'

Expected Telemetry

UDP/443 traffic to the msquic listener and, on a vulnerable build, service crash/restart entries (WER / coredump / systemd restart).

Expected Detection

Crash-burst correlation surfaces repeated restarts of a QUIC-linked service on a host with a vulnerable msquic version.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1203Exploitation for Client Execution

Same Tactic: Initial Access

Popular Detections